bugbounty

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

Real-world infosec wordlists, updated regularly

Metlo is an open-source API security platform.

OSINT power without API key hassle

A big list of Android Hackerone disclosed reports and other resources.

a recon tool that allows searching on URLs that are exposed via shortener services

Advanced LLM-powered brute-force tool combining AI intelligence with automated login attacks

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

A collection of one-liners for bug bounty hunting.

Asset inventory of over 800 public bug bounty programs.

ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes

Subdomain takeover vulnerability checker

GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).

Awesome Vulnerable Applications

Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

Security Tool to Look For Interesting Files in S3 Buckets

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

API Security Project aims to present unique attack & defense methods in API Security field

Some files for bruteforcing certain things.

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

Useful Google Dorks for WebSecurity and Bug Bounty

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

Community curated list of public bug bounty and responsible disclosure programs.

PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.

Agentic offensive-security in your terminal

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support.

The fastest dork scanner written in Go.